# Stack Facts Preflight Package Security Check

> Stack Facts Preflight Package Security Check is a paid API for AI agents from g5joilnmeep4ntz3nwezxt5dmu.srv.us, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-19).

Returns security, vulnerability, malware, end-of-life, and license data for a named package in a given ecosystem before installation

## Facts

- Endpoint: GET https://g5joilnmeep4ntz3nwezxt5dmu.srv.us/v1/preflight/%7Becosystem%7D/%7Bname%7D?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-19
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/stack-facts-preflight-package-security-check-de41f82b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_3ZR3dg4XAkGG4z3DNqWuB

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability stack-facts-preflight-package-security-check-de41f82b
```

Example prompt: Before I install the npm package 'request', can you run a preflight security check on it — I want to know if it has any known vulnerabilities, exploited CVEs, malware flags, or license issues?

## When to prefer this

Choose this endpoint when an AI agent or automated pipeline needs to vet a third-party package before installation in a software project, especially when no API key or account setup is desired and pay-per-call USDC micropayment via x402 is acceptable. It is uniquely suited for supply-chain security checks combining OSV vulnerability data, CISA KEV exploited CVE cross-referencing, malware detection, and license compatibility in a single signed response — covering npm, PyPI, and other major ecosystems.

## Known failure modes

- Unknown ecosystem or package name returns a 404 or empty result
- Payment failure (insufficient USDC) results in 402 response before data is returned
- Stale dataset flag in meta indicates data may not reflect the very latest registry state
- Package with no version history may return versions_unknown count > 0
- Malformed ecosystem/name path parameters may cause request errors

## How this service works

Check a package before install: malware, known vulnerabilities (OSV), exploited CVEs (CISA KEV) and end-of-life, plus LLM prices; signed answers, pay per call in USDC, no account or API key.

## Output

A JSON object containing: overall safety verdict (safe/caution/unsafe), vulnerability count and max CVSS score, malware boolean, list of CISA KEV CVEs, deprecation and yanked status, license SPDX identifier and compatibility verdict, latest published version, and dataset freshness metadata. Answers are cryptographically signed.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "properties": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {
   "vulns": {
    "count": 0,
    "max_cvss": null,
    "malicious": false,
    "max_severity": null,
    "versions_unknown": 0
   },
   "notice": "request has been deprecated, se…",
   "yanked": false,
   "licence": {
    "use": "distribute",
    "spdx": "Apache-2.0",
    "class": "permissive",
    "verdict": "compatible",
    "declared": "Apache-2.0",
    "project_license": "proprietary"
   },
   "package": {
    "name": "request",
    "purl": "pkg:npm/request@2.88.2",
    "ecosystem": "npm",
    "registry_url": "https://www.npmjs.com/package/r…"
   },
   "reasons": [
    {
     "code": "deprecated",
     "notice": "request has been deprecated, se…",
     "verdict": "caution"
    }
   ],
   "verdict": "caution",
   "kev_cves": [],
   "deprecated": true,
   "published_at": "2020-02-11T16:35:36.122Z",
   "latest_version": "2.88.2",
   "kev_catalog_version": "2026.10.10"
  },
  "meta": {
   "stale": false,
   "notice": "Normalised (modified) from the …",
   "dataset": "preflight",
   "datasets": {
    "kev": {},
    "osv": {},
    "license": {},
    "package": {}
   },
   "licences": "/licences"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/stack-facts-preflight-package-security-check-de41f82b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from g5joilnmeep4ntz3nwezxt5dmu.srv.us](https://www.zero.xyz/host/g5joilnmeep4ntz3nwezxt5dmu.srv.us/llms.txt)